This is a hotfix release for a regression affecting some Drush installations that was introduced by the fix for SA-CORE-2019-002. No other fixes are included.

If you continue to experience issues with Drush following this update, try the following:

Run update.php to ensure database updates are completed and to clear the site cache safely without Drush.

Check the site status report to confirm that 7.63 was successfully installed.

Test Drush again. If issues persist:

Rename your drush CLI file back to drush.phar.

Create a symlink named drush pointing to drush.phar

Alternately, try installing Drush with Composer instead of from a phar.

Important update information

The .phar file extension has been added to Drupal's dangerous extensions list, which means that any such file uploaded to a Drupal file field will automatically be converted to a text file (with the .txt extension) to prevent it from being executed. This is similar to how Drupal handles file uploads with a .php extension.

No changes have been made to the .htaccess, web.config, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary.

The replacement stream wrapper needed to resolve Drupal Core - Remote code execution - SA-CORE-2018-002 is not compatible with PHP versions lower than 5.3.3. For sites using lower PHP versions, the built-in phar stream wrapper has been disabled rather than replaced. Drupal 7 sites using PHP 5.2 (or PHP 5.3.0-5.3.2) that require phar support will need to re-enable the stream wrapper for it; however, note that re-enabling the stream wrapper will re-enable the insecure PHP behavior on those PHP versions.

It is very uncommon to both be running a PHP version lower than 5.3.3 and to need phar support. If you're in that situation, consider upgrading your PHP version instead of restoring insecure phar support.

Sites on 8.5.x or earlier should update immediately to Drupal 8.5.8 instead, and plan to update to the latest 8.6.x release before May 2019.

Important update information

The .phar file extension has been added to Drupal's dangerous extensions list, which means that any such file uploaded to a Drupal file field will automatically be converted to a text file (with the .txt extension) to prevent it from being executed. This is similar to how Drupal handles file uploads with a .php extension.

No changes have been made to the .htaccess, web.config, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary.

Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. Sites on 8.5.x will receive security coverage until May 2019.

Important update information

The .phar file extension has been added to Drupal's dangerous extensions list, which means that any such file uploaded to a Drupal file field will automatically be converted to a text file (with the .txt extension) to prevent it from being executed. This is similar to how Drupal handles file uploads with a .php extension.

No changes have been made to the .htaccess, web.config, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary.

The .phar file extension has been added to Drupal's dangerous extensions list, which means that any such file uploaded to a Drupal file field will automatically be converted to a text file (with the .txt extension) to prevent it from being executed. This is similar to how Drupal handles file uploads with a .php extension.

No changes have been made to the .htaccess, web.config, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary.

The replacement stream wrapper needed to resolve Drupal Core - Remote code execution - SA-CORE-2018-002 is not compatible with PHP versions lower than 5.3.3. For sites using lower PHP versions, the built-in phar stream wrapper has been disabled rather than replaced. Drupal 7 sites using PHP 5.2 (or PHP 5.3.0-5.3.2) that require phar support will need to re-enable the stream wrapper for it; however, note that re-enabling the stream wrapper will re-enable the insecure PHP behavior on those PHP versions.

It is very uncommon to both be running a PHP version lower than 5.3.3 and to need phar support. If you're in that situation, consider upgrading your PHP version instead of restoring insecure phar support.

#2309731 by bendeguz.csirmaz, phenaproxima, alexpott: drupal_check_profile() does not invoke the profile's hook_requirements()

#2575105 by Berdir, catch, amateescu: Use cache collector for state (revert)

#2990517 by tim.plunkett, alphex, xjm, phenaproxima, neclimdul: Adding a display mode to a content type using layout, and disabling layout on that new display mode removes the layout_builder__layout field and breaks layout in already configured display modes

#2866722 by shabana.navas, kpv: Avoid using display mode machine name in AccountForm::form()

Sites on 8.5.x should update immediately to Drupal 8.5.8 instead, and plan to update to the latest 8.6.x release before May 2019.

Important update information

Site update and module owners planning to update to this should take note of the following important changes.

For site owners

Previously, users who didn't have access to use any Content Moderation transitions were granted implicit access to update content provided the state of the content did not change. This access has been removed. Site owners should ensure that all content editor roles have access to appropriate transitions for moderated content types (including published to published where appropriate).

There are no database updates in this release, but site owners will need to run update.php to ensure a cache clear.

No changes have been made to the .htaccess, web.config, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary.

For contributed and custom module developers

\Drupal\Core\EventSubscriber\RedirectResponseSubscriber::sanitizeDestination() has been removed. If you have extended that class or are calling that method, you should review your implementation in line with the changes in the patch.

An additional method has been added to StateTransitionValidationInterface. Implementations should review the new method and ensure compatibility with it.

ModerationStateConstraintValidator now has two additional service dependencies. Subclasses will need to update their constructor to inject the new services.

Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. Sites on 8.5.x will receive security coverage until May 2019.

Important update information

Site update and module owners planning to update to this should take note of the following important changes.

For site owners

Previously, users who didn't have access to use any Content Moderation transitions were granted implicit access to update content provided the state of the content did not change. This access is been removed. Site owners should ensure that all content editor roles have access to appropriate transitions for moderated content types (including published to published where appropriate).

There are no database updates in this release, but site owners will need to run update.php to ensure a cache clear.

No changes have been made to the .htaccess, web.config, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary.

For contributed and custom module developers

\Drupal\Core\EventSubscriber\RedirectResponseSubscriber::sanitizeDestination() has been removed. If you have extended that class or are calling that method, you should review your implementation in line with the changes in the patch.

An additional method has been added to StateTransitionValidationInterface. Implementations should review the new method and ensure compatibility with it.

ModerationStateConstraintValidator now has two additional service dependencies. Subclasses will need to update their constructor to inject the new services.